Better web interface auth token fail error message

When auth fails, currently user just gets a 4xx error. Should give a proper error message; in general we should probably be passing 400 error messages though?

API error (from logs) was:
```
27278130-Jun 28 04:40:47 wbgrp-svc502.us.archive.org fatcat-web[25198]: HTTP response body: {"success":false,"error":"InvalidCredentials","message":"auth token was missing, expired, revoked, or corrupt: auth token (macaroon) not valid (signature and/or caveats failed)"}
```

In particular this impacts login expiration.